The Gamaredon APT group was discovered targeting Ukrainian government entities using the Telegram messaging service to avoid traditional network detection.
The Telegram messaging application was used in several stages, from victim profiling to delivering the final payload.
The initial infection vector was weaponized spear-phishing documents written in the Russian and Ukrainian languages.
The threat actor exploited a remote template injection vulnerability to compromise adversarial infrastructure with malware and bypass Microsoft Word macro protection.
After the malicious document was opened, the malware downloaded a Visual Basic script from a specific address which connected to a Telegram account to get additional instructions.
Sign Up For Threat Alerts
Feb 02, 2023
Ukraine CERT-UA: Compromised Email Address Used To...
An adversary was discovered using a compromised e-mail address to send phishing emails with a...
Feb 01, 2023
Ukraine Government Sector Targeted With The DolphinCape...
The government sector of Ukraine was targeted with spear-phishing emails with a malicious attachment which...
Feb 01, 2023
Ukraine Government Sector Targeted With The DolphinCape...
The government sector of Ukraine was targeted with spear-phishing emails with a malicious attachment which...
Jan 31, 2023
Multiple Malware Variants Distributed Through Microsoft OneNote
Spear-phishing emails with malicious Microsoft OneNote attachments were discovered delivering variants from the AsyncRAT, Formbook¸...
Jan 30, 2023
Playing Whack-a-Mole With New Dharma Ransomware Variants
The Dharma ransomware family was initially identified in 2016 and operates as a Ransomware-as-a-Service (RaaS)...
Jan 29, 2023
APT15 Targets Multiple Sectors With Turian Backdoor
APT15, also known as Playful Taurus, is an advanced persistent threat (APT) that conducts a...
Jan 26, 2023
Vice Society Ransomware Group Targets Manufacturing Companies
The Vice Society threat group was discovered targeting multiple sectors including manufacturing companies in Brazil....
Jan 26, 2023
US Cert Alert – Alert (AA23-025A) Protecting...
Although this campaign appears financially motivated, the authoring organizations assess it could lead to additional...
Jan 25, 2023
Emotet Malware Makes a Comeback with New...
The Emotet malware operation has continued to refine its tactics in an effort to fly...
Jan 25, 2023
DragonSpark
The DragonSpark attacks represent the first concrete malicious activity where Analysts observe the consistent use...
Jan 25, 2023
PLAY Ransomware
PLAY is simple but heavily obfuscated with a lot of unique tricks that have not...
Jan 23, 2023
NeedleDropper: A New Dropper-as-a-Service Uncovered
Avast's Threat Research Team has since October 2022 been observing a new strain of dropper...
Jan 22, 2023
Aurora Stealer Leverages Shapeshifting Tactics And Popular...
A threat actor was discovered mimicking legitimate websites to host and deliver the 9002 RAT,...
Jan 19, 2023
Earth Bogle Campaign Targets Entities With Geopolitical...
Middle Eastern geopolitical themed lures were used to distribute njRAT across the Middle East and...
Jan 18, 2023
The NoName057(16) Hacktivist Group Targets Ukraine Supporters...
The NoName057(16) hacktivist group targeted multiple sectors across Ukraine and neighboring countries with DDoS attacks....